This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Untrusted data is deserialized in **Goodlayers Hotel** plugin. <br>๐ฅ **Consequences**: Leads to **PHP Object Injection**.โฆ
๐ก๏ธ **Root Cause**: **CWE-502** (Deserialization of Untrusted Data). <br>๐ **Flaw**: The plugin fails to validate or sanitize data before passing it to PHP's `unserialize()` or similar functions.โฆ
๐ข **Affected Vendor**: **GoodLayers**. <br>๐ฆ **Product**: **Goodlayers Hotel** WordPress Plugin. <br>๐ **Versions**: **3.1.4 and earlier**. If you are running this version or older, you are at risk.
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: <br>1. **Remote Code Execution (RCE)** via object injection. <br>2. **Full System Control**: Read/write files, execute commands. <br>3.โฆ
๐ **Public Exploit**: **No specific PoC provided** in the CVE data. <br>โ ๏ธ **Risk**: High. Since CVSS is High and Auth is None, automated scanners and exploit kits likely target this class of vulnerability.โฆ